playbooks / email-to-identity

Email address → identity

Turn a single email address into registered accounts, usernames, a real name and a face, without ever contacting the owner.

start: ✉ emailyields: domain, company, username, url, real name, image, phone, location, ip / asnlevel: beginner

caution: Never log in with credentials found in breach data. That is unauthorised access in nearly every jurisdiction. Use breach records only as identifiers.

1. 01

   Sanity-check the address

   Confirm the mailbox plausibly exists and note the domain. A custom domain (not gmail/outlook/proton) is itself a lead: it points to a company or a personal site you can run through the domain playbook.

   Verification tools talk to the mail server, not the person, but avoid hammering the same address.

   • Verify Email Addressfreedetails
   • Email Hippofreemiumacct optionalapidetails
   • EmailRepfreemiumacct optionalapidetails

   → can yield: ◎Domain ▤Company

2. 02

   Search the address literally

   Quote the full address in several engines. Also search the local part (before the @) on its own, since people often reuse it as a username. Try "jdoe1987" -site:gmail.com.

   • Google Advanced Searchresource
   • Bingresource
   • Yandex Searchresource

   → can yield: @Username ⇗URL ☺Real name

3. 03

   Find which services it's registered on

   These tools check sign-up and password-reset flows to see which platforms know the address. Results often include profile names, avatars and partial phone numbers.

   Epieos and OSINT Industries surface Google account data (name, Maps reviews, calendar) when it's public.

   • holehefreeossclidetails
   • Epieosfreemiumacct optionalapidetails
   • OSINT Industriespaidacct reqapidetails
   • GHuntfreeacct reqosscliextensiondetails

   → can yield: @Username ☺Real name ▣Image ☎Phone ⊕Location

4. 04

   Check breach exposure

   Breach records link the email to usernames, old passwords (as hashes), IPs, phone numbers and physical addresses from other compromised services. Breach dates also tell you how long the address has been in use.

   • Have I Been Pwnedfreemiumapidetails
   • LeakCheckfreemiumacct optionalapidetails
   • DeHashedpaidacct reqapidetails
   • Intelligence Xfreemiumacct optionalapidetails
   • Hudson Rock Infostealer Lookupfreeapidetails

   → can yield: @Username ☎Phone ⌖IP / ASN ☺Real name ⊕Location

5. 05

   Pivot

   You should now have at least one username and possibly a name or phone number. Run them through their own playbooks, then compare avatars, bios and timelines across results to confirm they're the same person.

   → can yield: @Username ☎Phone ☺Real name